phone-mark-query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.0.2

Overview

This skill appears to perform the advertised phone-number lookup, but it sends queried numbers and a persistent device ID to a third-party service over unencrypted HTTP.

Review before installing. This skill sends every queried phone number and a stable device identifier to an external service using unencrypted HTTP, and the backend URL can be changed by environment variable. Use it only if that privacy and integrity risk is acceptable, and prefer a version that uses HTTPS, validates the endpoint, and clearly discloses third-party data handling.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/query.py:31

Finding

Phone Numbers and Persistent Device Identifiers Transmitted over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'req' from os.environ.get (line 150, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/query.py (reported line 151)May include surrounding context.

python

for attempt in range(1, MAX_ATTEMPTS + 1):
        try:
            req = urllib.request.Request(url, headers={"User-Agent": UA})
            with urllib.request.urlopen(req, timeout=TIMEOUT_SECONDS) as resp:
                raw = resp.read().decode("utf-8", "replace")
            return json.loads(raw)
        except (urllib.error.URLError, TimeoutError, OSError,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes a Python script and explicitly documents use of environment variables, local state files under the user's home directory, and outbound HTTP requests, but it declares no corresponding tool scope or permissions. This creates a transparency and containment gap: the runtime may grant broader capabilities than users or deployers expect, increasing the risk of unintended file, environment, or network access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use the skill when users ask phrases like "这号码是谁的/该不该接/是不是骚扰诈骗电话/查下标记". Several of these, especially "这号码是谁的" and "该不该接", are broad everyday utterances without clear scope constraints or exclusion conditions, which could cause unintended invocation outside this skill's intended context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends queried phone numbers and a generated persistent device UID to an external service for lookup and metering, but this disclosure is buried in author notes rather than presented as a clear user-facing warning. Because phone numbers are personal data and the UID enables cross-request linkage, users may unknowingly expose sensitive information to a third party.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Allowing the backend API URL to be overridden via an environment variable enables redirection of phone numbers and device UID data to an arbitrary endpoint. In practice, anyone controlling the environment or deployment wrapper can silently exfiltrate sensitive queried numbers, track users across requests, or repurpose the skill as a generic network egress mechanism.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Allowing the backend API endpoint to be overridden by an environment variable turns a purpose-specific query tool into a generic outbound HTTP client to arbitrary destinations. In environments where untrusted parties can influence environment variables, this can enable SSRF-style internal network access, unintended data exfiltration, or requests to attacker-controlled hosts containing queried phone numbers and the persistent UID.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends both the queried phone number and a persistent device UID to a remote service without an obvious user-facing disclosure or consent step. This exposes sensitive personal/contact data and a stable identifier to a third party, enabling tracking, query correlation, and possible regulatory/privacy issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user instructions, invocation examples, and response requirements are specified only in Chinese, including mandated answer phrasing such as using "风险等级 + 平台命中数（x/9）+ 接听建议". There is no opt-in for language preference or documented rationale that this skill must operate only in Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The natural-language description, help text, and user-facing messages are entirely in Chinese, which effectively forces a specific language without user opt-in. There is no indication that the tool is intentionally region- or locale-specific, nor any mechanism to choose another language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script creates a persistent per-device UID and later includes it in output, which exceeds the minimum data needed to answer a phone-mark query. While not overtly malicious, persistent identifiers increase privacy risk because they enable correlation of multiple queries across time and systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Persistently storing a device UID locally creates a durable identifier without clear notice, which is a privacy issue even before any network transmission occurs. The risk is lower than active exfiltration, but it still expands the skill's data collection footprint beyond a simple one-off lookup.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest emphasizes out-of-the-box phone-mark lookup with a daily free limit, but this script implements local state mutation for quota tracking and a writable configuration store. While related to monetization/usage control, it is additional behavior beyond the core act of querying and aggregating phone-risk marks.

Content

No source excerpt is available for this finding.